55 lines
1.6 KiB
Django/Jinja
55 lines
1.6 KiB
Django/Jinja
# {{ ansible_managed }}
|
|
|
|
server:
|
|
# Timestamps use UTC ASCII instead of UNIX epoch.
|
|
log-time-ascii: yes
|
|
|
|
# Only log errors.
|
|
verbosity: 0
|
|
log-servfail: yes
|
|
|
|
logfile: "/var/log/unbound/unbound.log"
|
|
|
|
do-ip4: yes
|
|
# FIXME: IPv6 deployment... someday...
|
|
do-ip6: no
|
|
|
|
# IP addresses on which to listen.
|
|
interface: 10.{{ subnet_ids.ap }}.0.{{ dns_host_suffix }}
|
|
interface: 10.{{ subnet_ids.users_wired }}.0.{{ dns_host_suffix }}
|
|
interface: 10.{{ subnet_ids.users_wifi }}.0.{{ dns_host_suffix }}
|
|
|
|
|
|
# By default, anything other than localhost is refused.
|
|
# Whitelist some subnets:
|
|
access-control: 10.{{ subnet_ids.ap }}.0.0/16 allow
|
|
access-control: 10.{{ subnet_ids.users_wired }}.0.0/16 allow
|
|
access-control: 10.{{ subnet_ids.users_wifi }}.0.0/16 allow
|
|
|
|
num-threads: {{ ansible_processor_vcpus }}
|
|
|
|
private-address: 10.0.0.0/8
|
|
|
|
# XXX
|
|
# We've been having issues with bogus DNSSEC responses, and unintended
|
|
# blacklisting of nameservers because of that.
|
|
# The following is intended as a stopgap solution.
|
|
#
|
|
# unbound had issues with auro.re's DS records, apparently;
|
|
# it kept receiving an error, which subsequently caused a blacklisting
|
|
# of relevant servers and an inability to resolve auro.re and its
|
|
# subdomains.
|
|
#
|
|
# auro.re does not have DNSSEC anyway, so we can treat it as insecure.
|
|
domain-insecure: "auro.re"
|
|
|
|
|
|
# The host cache TTL affects blacklisting of supposedly bogus hosts.
|
|
# The default was 900 (15 minutes).
|
|
infra-host-ttl: 60
|
|
|
|
harden-dnssec-stripped: no
|
|
disable-dnssec-lame-check: yes
|
|
|
|
|
|
|